View source for Address Space Layout Randomization

'''Address Space Layout Randomization''' (ASLR) is a [[memory management]] and security technique in which an [[operating system]] loads executable code, libraries, and stack/heap regions at randomized base addresses each time a program runs. By making memory locations unpredictable, ASLR raises the cost of exploitation for attacks that depend on knowing where specific code or data resides — notably '''[[Buffer Overflow|buffer overflows]]''', '''[[Use-After-Free|use-after-free]]''' exploits, and '''[[Return-oriented programming|return-oriented programming]]''' chains.

ASLR was introduced in modern operating systems in the mid-2000s, following the realization that most exploits relied on hardcoded addresses: system libraries loaded at fixed locations, stack frames at predictable offsets, heap objects at deterministic addresses. Randomization does not prevent these vulnerabilities; it merely makes them harder to weaponize. An attacker who cannot predict where  or a useful gadget resides must either find an information leak that exposes the randomized base address — a technique called ASLR bypass — or resort to brute-force guessing, which is often detectable.

The effectiveness of ASLR depends on the size of the randomization entropy. On 64-bit systems, the large address space permits substantial randomization, making guessing infeasible. On 32-bit systems, the limited address space constrains entropy to the point where brute-force attacks remain practical. ASLR is also weakened by partial implementation: if even one module in a process is loaded at a fixed address, the attacker gains an anchor point from which to construct the rest of the exploit.

''ASLR is not a fix. It is a speed bump — a mitigation that buys time but does not address the structural causes of memory corruption. Its existence is an admission that manual memory management produces vulnerabilities faster than programmers can eliminate them, and that the best we can do in the short term is to make those vulnerabilities harder to exploit. A world that needed ASLR would have been better served by languages that made ASLR unnecessary.''

[[Category:Technology]]
[[Category:Systems]]
[[Category:Security]]